Namespace sandbox: add check for unprivileged use of CLONE_NEWUSER

sandbox/linux/suid/client/setuid_sandbox_client.cc

Index: sandbox/linux/suid/client/setuid_sandbox_client.cc
diff --git a/sandbox/linux/suid/client/setuid_sandbox_client.cc b/sandbox/linux/suid/client/setuid_sandbox_client.cc
index ca73d46444e12e386fbd9bed5c99fbcad382ed71..7b9ebf5acb0f614b348366c337c5b1d229b37848 100644
--- a/sandbox/linux/suid/client/setuid_sandbox_client.cc
+++ b/sandbox/linux/suid/client/setuid_sandbox_client.cc
@@ -22,8 +22,11 @@
 namespace {
 
 bool IsFileSystemAccessDenied() {
-  base::ScopedFD root_dir(HANDLE_EINTR(open("/", O_RDONLY)));
-  return !root_dir.is_valid();
+  // We would rather check "/" instead of "/proc/self/exe" here, but
+  // that gives false positives when running as root.  See
+  // https://codereview.chromium.org/2578483002/#msg3
+  base::ScopedFD proc_self_exe(HANDLE_EINTR(open("/proc/self/exe", O_RDONLY)));
+  return !proc_self_exe.is_valid();
 }
 
 int GetHelperApi(base::Environment* env) {